CVE-2026-33328

Name	CVE-2026-33328
Description	libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vips (PTS)	bookworm	8.14.1-3+deb12u3	vulnerable
	bookworm (security)	8.14.1-3+deb12u2	vulnerable
	trixie	8.16.1-1+deb13u1	vulnerable
	forky	8.18.6-1	fixed
	sid	8.18.6-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vips	source	(unstable)	8.18.1-1

Notes

https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7
https://github.com/libvips/libvips/pull/4935
Fixed by: https://github.com/libvips/libvips/commit/9b633e45abfcf1fc4c84847007c81805193c0969 (v8.18.1)